Malicious code in ded-pwa-ded-pwa-core (npm)
The npm package ded-pwa-ded-pwa-core version 35.6.3 contains malicious code that executes arbitrary binaries on the host system. Upon requiring the package, it downloads an opaque binary from author-controlled Cloudflare Workers endpoints, writes it to disk with disguised filenames, sets executable permissions, and spawns it detached from the main process. The package uses obfuscation techniques to evade detection, including runtime hostname reconstruction and split-string method calls. This results in arbitrary code execution on any system that installs or requires this package.
AI Analysis
Technical Summary
The ded-pwa-ded-pwa-core npm package version 35.6.3 includes a backdoor mechanism where requiring the package triggers the loading of a platform-specific binary fetched over HTTPS from obfuscated Cloudflare Workers URLs controlled by the attacker. The binary is saved to a temporary location with filenames mimicking legitimate .NET diagnostics or cache files, given executable permissions, and executed detached from the main process. The package employs runtime string concatenation to evade static analysis and includes a DNS-TXT fallback for binary retrieval. Environment variables related to telemetry are checked to provide a cover story, but the executed binary is opaque, author-controlled, and not verified by hash or version pinning. This leads to arbitrary code execution on the host system.
Potential Impact
Installing or requiring ded-pwa-ded-pwa-core version 35.6.3 results in arbitrary code execution on the host machine. This allows the attacker to run any code with the privileges of the user installing or requiring the package, potentially leading to full system compromise, data theft, or persistence. The obfuscation and lack of integrity checks increase the risk of undetected malicious activity.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or requiring ded-pwa-ded-pwa-core version 35.6.3. Remove the package from any affected systems and audit for any unauthorized binaries or processes spawned by it. Monitor for updates from the package maintainers or npm advisories for any official fixes or removal. Due to the malicious nature, consider blocking the package in organizational package registries and scanning for its presence in existing projects.
Malicious code in ded-pwa-ded-pwa-core (npm)
Description
The npm package ded-pwa-ded-pwa-core version 35.6.3 contains malicious code that executes arbitrary binaries on the host system. Upon requiring the package, it downloads an opaque binary from author-controlled Cloudflare Workers endpoints, writes it to disk with disguised filenames, sets executable permissions, and spawns it detached from the main process. The package uses obfuscation techniques to evade detection, including runtime hostname reconstruction and split-string method calls. This results in arbitrary code execution on any system that installs or requires this package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ded-pwa-ded-pwa-core npm package version 35.6.3 includes a backdoor mechanism where requiring the package triggers the loading of a platform-specific binary fetched over HTTPS from obfuscated Cloudflare Workers URLs controlled by the attacker. The binary is saved to a temporary location with filenames mimicking legitimate .NET diagnostics or cache files, given executable permissions, and executed detached from the main process. The package employs runtime string concatenation to evade static analysis and includes a DNS-TXT fallback for binary retrieval. Environment variables related to telemetry are checked to provide a cover story, but the executed binary is opaque, author-controlled, and not verified by hash or version pinning. This leads to arbitrary code execution on the host system.
Potential Impact
Installing or requiring ded-pwa-ded-pwa-core version 35.6.3 results in arbitrary code execution on the host machine. This allows the attacker to run any code with the privileges of the user installing or requiring the package, potentially leading to full system compromise, data theft, or persistence. The obfuscation and lack of integrity checks increase the risk of undetected malicious activity.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or requiring ded-pwa-ded-pwa-core version 35.6.3. Remove the package from any affected systems and audit for any unauthorized binaries or processes spawned by it. Monitor for updates from the package maintainers or npm advisories for any official fixes or removal. Due to the malicious nature, consider blocking the package in organizational package registries and scanning for its presence in existing projects.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13498
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75f712bf8831d53984fbd9
Added to database: 08/07/2026, 15:17:38 UTC
Last enriched: 08/07/2026, 15:45:17 UTC
Last updated: 08/07/2026, 16:21:07 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.